[[!tag kerberos howto]]
#### Why enable Kerberos on your system?
Convenience and security. With
[Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single
login grants access to all NetBSD web services. Configuration is easy
and you only have to do it once (sometimes less).
#### [[!toggle id="macosx" text="Mac OS X"]]
[[!toggleable id="macosx" text="""
OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS.
To use Kerberized TNF services, log in with your Kerberos [[password]]:
`$ kinit @NETBSD.ORG`
The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
##### A Keychain trick
To pop up a GUI password dialog:
`$ kinit @NETBSD.ORG @NETBSD.ORG`
The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
"""]]
#### [[!toggle id="windows" text="Windows XP"]]
[[!toggleable id="windows" text="""
Windows does not provide an easy way to configure and use KDCs different from the one embedded into an Active Directory.
Therefore, to use [[Kerberos]], you should follow the following steps:
7. Download the [MIT Kerberos for Windows](http://web.mit.edu/Kerberos/dist/#kfw-3.2) installer. It is composed of different tools traditionally found with Kerberos distributions, like [[!template id=man name=kinit section=1]] or [[!template id=man name=klist section=1]], and a Network Identity Manager, an application used to manage credential caching of Kerberos tickets.
7. Install the package. Use the default provided options, then restart the computer.
7. The Network Identity Manager [(PDF)](http://web.mit.edu/kerberos/kfw-3.2/kfw-3.2.2/netidmgr_userdoc.pdf) should automatically start when you login. As there is no principal currently configured, it should open a dialog box to obtain the new credentials.
7. Enter your principal:
Username:
Realm: NETBSD.ORG
7. Click `Ok`. After a few seconds, it should obtain the TGT for you from NetBSD.ORG KDC.
"""]]